Medium severity · published Oct 21, 2026
CVE-2026-114076
Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114076
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint